MDL-15450 CSRF prevention

user/edit.html

@@ -396,4 +396,5 @@ if (isadmin()) {
 </table>
 <input type="hidden" name="course" value="<?php p($course->id) ?>" />
 <input type="hidden" name="id" value="<?php p($user->id) ?>" />
+<input type="hidden" name="sesskey" value="<?php p(sesskey()) ?>" />
 </form>

user/edit.php

@@ -69,7 +69,7 @@
     
 /// If data submitted, then process and store.
 
-    if ($usernew = data_submitted()) {
+    if ($usernew = data_submitted() and confirm_sesskey()) {
 
         if (($USER->id <> $usernew->id) && !isadmin()) {
             print_error('onlyeditown');